mesa-panvk-bifrost r7: fix XFB store channel-extract for packed varyings (iter19)

Adds 0007-panvk-bifrost-xfb-component-base-fix.patch — eliminates a
reliable SIGSEGV in vkCreateGraphicsPipeline whenever an XFB-bound
vertex output is declared with non-zero `layout (component=N)`.

Surfaced by dEQP-VK.transform_feedback.simple.holes_vert (Mali-G52 r1
MC1, PAN_ARCH 7). Backtrace lands 11 frames into libvulkan_panfrost.so
called from vkt::TransformFeedback::TransformFeedbackHolesInstance::
iterate.

Root cause: iter17's lower_xfb_output_iter17 (and upstream
pan_nir_lower_xfb, which has the identical `// TODO`) computes the
source-channel mask as `mask << channel_idx`, where channel_idx is
the varying-location component (0..3) but src only contains channels
starting at nir_intrinsic_component(intr). For a scalar declared
component=2, the lowering computed `mask << 2` against a 1-component
src — out-of-range; the malformed nir_def segfaulted in downstream
NIR constant-folding (nir_constant_expressions.c::evaluate_*).

Fix translates channel_idx to source-channel space by subtracting
nir_intrinsic_component(intr) before shifting the mask, and replaces
the elided release-mode asserts with explicit release-mode guards
(closes the same elision class as the original bug).

Verified on PineTab2 (Mali-G52 r1 MC1, PAN_ARCH 7) against vulkan-cts
1.3.10.0:
  - holes_vert / holes_extra_draw_vert no longer SIGSEGV (now Fail
    on color-check; that is a separate iter20 finding).
  - basic_*: 36/36 Pass. depth_clip_*: 1 Pass + 4 NotSupported.
    lines_or_triangles*: 16 NotSupported. 0 Fail across the set.

Caveat (not regressions): max_output_components_64/_128/_256 were
never reached on the r5 sweep — watchdog killed transform_feedback
after the holes_vert crash. With this fix in place, they now run
and surface their own pre-existing coredumps, confirmed on shipped
r6 baseline too. iter20+ territory.

Phase 5 (2nd-model) review: APPROVE WITH CHANGES (non-blocking).
Changes applied: release-mode defensive guards on both preconditions
plus a dispatcher-side comment clarifying the i*2+j semantics.

Cross-refs:
  - ~/src/panvk-bifrost/iter19/phase{0,1,2,3}_holes_vert*.md

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

arch/mesa-panvk-bifrost/PKGBUILD

@@ -30,7 +30,7 @@
 
 pkgname=mesa-panvk-bifrost
 _mesaver=26.0.6
-pkgver=26.0.6.r6
+pkgver=26.0.6.r7
 pkgrel=1
 pkgdesc="Patched Mesa libvulkan_panfrost.so exposing Bifrost-gen Mali to Vulkan apps (panvk-bifrost campaign)"
 arch=('aarch64')
@@ -83,6 +83,7 @@ source=(
     "0004-panvk-bifrost-xfb-primitive-decomposition.patch"
     "0005-panvk-bifrost-fragment-stores-atomics.patch"
     "0006-panvk-bifrost-legacy-dithering.patch"
+    "0007-panvk-bifrost-xfb-component-base-fix.patch"
     "brave-vulkan"
     "icd.json"
 )
@@ -96,6 +97,7 @@ sha256sums=(
     'SKIP'
     'SKIP'
     'SKIP'
+    'SKIP'
 )
 
 prepare() {
@@ -152,6 +154,16 @@ prepare() {
     # extension as Mali-G52-architecture supported.
     patch -p1 < "${srcdir}/0006-panvk-bifrost-legacy-dithering.patch"
 
+    # r7 (2026-05-25): XFB store channel-extract fix for packed varyings.
+    # Eliminates a reliable SIGSEGV in vkCreateGraphicsPipeline whenever
+    # an XFB-bound vertex output is declared with non-zero
+    # `layout (component=N)`. Surfaced by dEQP-VK.transform_feedback.
+    # simple.holes_vert (now Fails on color-check rather than crashing;
+    # the color-check residual is a separate iter20 finding).
+    # Phase-doc context: ~/src/panvk-bifrost/iter19/phase{0,1,2,3}_*.md.
+    # Phase 5 reviewed; release-mode-elision defensive guards applied.
+    patch -p1 < "${srcdir}/0007-panvk-bifrost-xfb-component-base-fix.patch"
+
     # Sanity-check the patches landed.
     grep -q "KHR_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
     grep -q "EXT_robustness2 = true," src/panfrost/vulkan/panvk_vX_physical_device.c
@@ -171,6 +183,9 @@ prepare() {
     grep -q "xfb_topology" src/panfrost/vulkan/panvk_shader.h
     grep -q "panvk_xfb_topology" src/panfrost/vulkan/panvk_shader.h
     test -f src/panfrost/vulkan/panvk_vX_xfb_lower.c
+    # r7 sanity: XFB channel-base correction landed
+    grep -q "iter19: nir_intrinsic_component(intr) is the source-channel base" src/panfrost/vulkan/panvk_vX_xfb_lower.c
+    grep -q "mask << src_channel" src/panfrost/vulkan/panvk_vX_xfb_lower.c
 }
 
 build() {